The invention relates to a method of storing data on a rewritale data storage medium, to a storage medium, to a recording apparatus for storing data on a rewritable data storage medium and to a playback apparatus for playback of user data stored on a rewritable data storage medium.
The invention addresses a storage medium on which users can store copyrighted and copy-free material. Often the user has a right to store and copy content, but there are restrictions to the number of (generations of) copies that he can make. Encryption is used to ensure that copy-righted content can only be interpreted by xe2x80x9ccompliantxe2x80x9d devices which adhere to copy protective restrictions. A further protection is needed to avoid that non-compliant devices can make a bitwise copy of encrypted data. This is often avoided by storing essential information, e.g. a decryption key, in a manner that can not be copied.
More generally it is concluded that copy-protective measures require that on recordable discs some data must be stored which shall not be modifiable or erasable by consumer end products. These data will be called xe2x80x9csystem dataxe2x80x9d in the following. Examples of xe2x80x9csystem dataxe2x80x9d are:
a unique disc identifier number which is used to encrypt the data that the user stores on the disc,
a list consisting of a single key which has been encrypted with a number of different manufacturer-specific or device-specific keys,
a list of electronic serial numbers of revoked devices or revoked discs. By storing such a list on all blank discs, revocation instructions can be disseminated to consumer devices. Upon receipt of such revocation instructions, compliant devices refuse to communicate with revoked devices.
Content or data recorded by the user will be called xe2x80x9cuser dataxe2x80x9d in the following. Moreover, the term xe2x80x9cfixed data areaxe2x80x9d will be used for an area of the storage medium in which any information is stored that is read-only and not modifiable by consumer devices. On the contrary, in the xe2x80x9crecordable data areaxe2x80x9d information is stored which can be modified by consumer devices. Also data, which can only be written by consumer devices after some modifications (xe2x80x9chacksxe2x80x9d) have been made to the device by malicious users will be stored in the recordable data area. Such modifications can be a change in the firmware or software used to control the recorder.
To store data in the fixed data area requires the use of components which are typically not available in consumer devices. An example of a technique to store such data is a xe2x80x9cwobblexe2x80x9d, which is a radial deviation of the pit positions or the pregroove from a perfect spiral. Laws of physics and mechanics prohibit that such a wobble can be written on the fly by a laser as available in a consumer recorder for optical discs. Other examples of data stored in the fixed data area are the BCA code, proposed for DVD-ROM, selectively damaged spots on the disc material burned by high power lasers, or data stored in a special area of the disc which contains read-only material.
A practical problem is the storage of large quantities of data in the fixed data area. Typically the capacity is limited to a few (hundreds of) bits. Meanwhile the amount of system data that needs to be stored may well exceed the storage capacity available in the fixed data area.
The invention has therefore for its object to provide a method of storing data on a rewritable data storage medium according to which the above mentioned problems are overcome and which allows the storage of large quantities of system data in a tamper-resistant manner. Further, a corresponding storage medium, a corresponding recording apparatus and a corresponding playback apparatus shall be provided.
These objects are achieved according to the invention by a method as set forth in claim 1 or 2, by a storage medium as set forth in claim 9 or 10, by a recording apparatus as set forth in claim 12 or 13 and by a playback apparatus as set forth in claim 14 or 15.
The invention is mainly based on the idea that there exists some cryptographic relationship between data stored in the fixed data area and system data. This relationship is made up by the cryptographic summary which is according to the invention generated from the system data alone or from both the system data and identification data which can be a random number stored in the fixed data area. This cryptographic summary is used by a recording or playback apparatus to detect whether the system data have been tampered with, e.g. erased or modified in order to manipulate the copy proctection of the storage medium. The cryptographic summary is thus used for verification of the system data which means that in case of a verification failure playback or recording of the content of the storage medium can be stopped.
According to a first solution the system data are written in the recordable data area, e.g. as part of the formatting of the storage medium. A cryptographic summary, e.g. a cryptographic hash, is computed over the system data, and the result of that cryptographic summary, e.g. the result of that hash, is stored in the fixed data area. A recording apparatus will then only accept a storage medium with a valid combination of system data and fixed data, i.e. cryptographic summary.
According to an alternative solution identification data, e.g. a random number, are created and stored in the fixed data area. The recordable data area then contains the user data, the system data and a cryptographic summary of the system data and the identification data, e.g. an electronic signature thereof. A recording or playback apparatus will then use a verifier (e.g. a public key) to check the validity of the cryptographic summary, the system data and the identification data, i.e. the validity of the signature will be checked. Instead of using an electronic signature a message authentication code (MAC) can be used for the verification which is cheaper but less secure.
Other preferred embodiments of the invention are disclosed in the dependent claims.